Create codeql-actions.yml

.github/workflows/codeql-actions.yml

@@ -0,0 +1,39 @@
+name: "Code Scanning: GitHub Actions"
+on:
+  pull_request:
+  merge_group:
+permissions:
+  security-events: write
+  # required to fetch internal or private CodeQL packs
+  packages: read
+  actions: read
+  contents: read
+defaults:
+  run:
+    shell: bash
+jobs:
+  code-scanning:
+    name: Code Scanning
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    strategy:
+      fail-fast: false
+    steps:
+      - name: Checkout Repository
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@ce28f5bb42b7a9f2c824e633a3f6ee835bab6858
+        with:
+          languages: actions
+          build-mode: none
+      - name: Perform CodeQL Analysis
+        id: codeql
+        uses: github/codeql-action/analyze@ce28f5bb42b7a9f2c824e633a3f6ee835bab6858
+        with:
+          category: "/language:actions"
+          output: sarif-results
+          upload: failure-only
+      - name: Process & Upload SARIF
+        uses: braintree/security-workflows/.github/actions/upload-sarif@main
+        with:
+          sarif_dir: ${{ env.CODEQL_ACTION_SARIF_RESULTS_OUTPUT_DIR }}